{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "provenance": []
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "language_info": {
      "name": "python"
    }
  },
  "cells": [
    {
      "cell_type": "code",
      "execution_count": null,
      "metadata": {
        "id": "ASWk1jCApXkF"
      },
      "outputs": [],
      "source": []
    },
    {
      "cell_type": "markdown",
      "source": [
        "# Logging Artifacts"
      ],
      "metadata": {
        "id": "8D3WjDxdqHfW"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "Use this section to keep your suggested logs for the use case"
      ],
      "metadata": {
        "id": "mAILNiF6qeCU"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "\n",
        "\n",
        "```\n",
        "type=SYSCALL msg=audit(1664132300.181:236): arch=c000003e syscall=59 success=yes exit=0 a0=7fffd11e5500 a1=7fffd11e4b50 a2=7fffd11e4c48 a3=0 items=0 ppid=3086 pid=3167 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=5 comm=\"sshd\" exe=\"/usr/sbin/sshd\" key=(null)\n",
        "type=USER_AUTH msg=audit(1664132300.181:237): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:authentication acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n",
        "type=USER_START msg=audit(1664132300.181:238): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:session_open acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n",
        "type=SYSCALL msg=audit(1664132305.181:239): arch=c000003e syscall=59 success=yes exit=0 a0=55b50fb0f330 a1=7fffd11e4b90 a2=7fffd11e4c88 a3=0 items=0 ppid=3167 pid=3169 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=5 comm=\"bash\" exe=\"/usr/bin/bash\" key=(null)\n",
        "type=CWD msg=audit(1664132305.181:240): cwd=\"/home/jsmith\"\n",
        "type=PATH msg=audit(1664132305.181:241): item=0 name=\"/bin/ls\" inode=131099 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\n",
        "type=USER_END msg=audit(1664132420.246:242): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:session_close acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n",
        "```\n",
        "\n"
      ],
      "metadata": {
        "id": "svFdMWyNqmUB"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "#grab log data as string and check for accuracy\n",
        "file = open('tests/audit-example-log.txt', 'r')\n",
        "log_contents = file.read()"
      ],
      "metadata": {
        "id": "Z_LxfbzXtR-O"
      },
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "source": [
        "print(log_contents)"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "fKz-x9nOtnFh",
        "outputId": "fd6fc210-23f9-449c-f083-eb1a39a6098d"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "type=SYSCALL msg=audit(1664132300.181:236): arch=c000003e syscall=59 success=yes exit=0 a0=7fffd11e5500 a1=7fffd11e4b50 a2=7fffd11e4c48 a3=0 items=0 ppid=3086 pid=3167 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=5 comm=\"sshd\" exe=\"/usr/sbin/sshd\" key=(null)\n",
            "type=USER_AUTH msg=audit(1664132300.181:237): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:authentication acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n",
            "type=USER_START msg=audit(1664132300.181:238): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:session_open acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n",
            "type=SYSCALL msg=audit(1664132305.181:239): arch=c000003e syscall=59 success=yes exit=0 a0=55b50fb0f330 a1=7fffd11e4b90 a2=7fffd11e4c88 a3=0 items=0 ppid=3167 pid=3169 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=5 comm=\"bash\" exe=\"/usr/bin/bash\" key=(null) \n",
            "type=CWD msg=audit(1664132305.181:240): cwd=\"/home/jsmith\"\n",
            "type=PATH msg=audit(1664132305.181:241): item=0 name=\"/bin/ls\" inode=131099 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0\n",
            "type=USER_END msg=audit(1664132420.246:242): user pid=3167 uid=0 auid=1000 ses=5 msg='op=PAM:session_close acct=\"jsmith\" exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=ssh res=success'\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "# Splunk SPL Dev"
      ],
      "metadata": {
        "id": "ptjMJSzCqQE2"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "Use this section to craft out your SPL"
      ],
      "metadata": {
        "id": "uhIPpPN6qxUq"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "\n",
        "\n",
        "```\n",
        "index=main exe=*bash\n",
        "```\n",
        "\n"
      ],
      "metadata": {
        "id": "tEBqqd-Pq1XB"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "spl_search = 'index=main exe=*bash'"
      ],
      "metadata": {
        "id": "tJ34Zr7Bt26R"
      },
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "source": [
        "# Send to CI/CD Pipeline"
      ],
      "metadata": {
        "id": "rxnHPC35qT8K"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "#grab github access token\n",
        "from google.colab import userdata\n",
        "GITHUB_TOKEN=userdata.get('GITHUB_TOKEN')\n",
        "print(type(GITHUB_TOKEN)) #verify something is populated"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "JKZqJ2luwdwx",
        "outputId": "d5093d6d-eaa7-42cd-eacc-a4c0ab7f124e"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "<class 'str'>\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "#do git session activity\n",
        "%cd /content\n",
        "!git config --global user.name \"Dennis Chow\"\n",
        "!git config --global user.email \"dchow@xtecsystems.com\"\n",
        "!git clone https://$GITHUB_TOKEN@github.com/dc401/splunk-integration-test-ci-demo.git\n",
        "%cd splunk-integration-test-ci-demo\n",
        "!cp /content/buildspec.txt /content/splunk-integration-test-ci-demo\n",
        "!git add buildspec.txt\n",
        "!git commit -m \"added buildspec\"\n",
        "!git push\n",
        "!git status"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "3G14hifDqKje",
        "outputId": "f01c39a8-6336-4ed4-a817-7f7b4c1d01d7"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "/content\n",
            "Cloning into 'splunk-integration-test-ci-demo'...\n",
            "remote: Enumerating objects: 15, done.\u001b[K\n",
            "remote: Counting objects: 100% (15/15), done.\u001b[K\n",
            "remote: Compressing objects: 100% (12/12), done.\u001b[K\n",
            "remote: Total 15 (delta 1), reused 4 (delta 1), pack-reused 0\u001b[K\n",
            "Receiving objects: 100% (15/15), 6.58 KiB | 6.58 MiB/s, done.\n",
            "Resolving deltas: 100% (1/1), done.\n",
            "/content/splunk-integration-test-ci-demo\n",
            "[main 7d8a12f] added buildspec\n",
            " 1 file changed, 2 insertions(+)\n",
            " create mode 100644 buildspec.txt\n",
            "Enumerating objects: 4, done.\n",
            "Counting objects: 100% (4/4), done.\n",
            "Delta compression using up to 2 threads\n",
            "Compressing objects: 100% (2/2), done.\n",
            "Writing objects: 100% (3/3), 345 bytes | 345.00 KiB/s, done.\n",
            "Total 3 (delta 1), reused 2 (delta 1), pack-reused 0\n",
            "remote: Resolving deltas: 100% (1/1), completed with 1 local object.\u001b[K\n",
            "To https://github.com/dc401/splunk-integration-test-ci-demo.git\n",
            "   7820448..7d8a12f  main -> main\n",
            "On branch main\n",
            "Your branch is up to date with 'origin/main'.\n",
            "\n",
            "nothing to commit, working tree clean\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "#revert from clone if needed\n",
        "%cd /content\n",
        "!rm -rf ./splunk-integration-test-ci-demo\n",
        "!pwd"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "g4IX1qGrydJC",
        "outputId": "d5859ad8-28b5-46f0-eb52-ae4b7a5653f4"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "/content\n",
            "/content\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "Ensure that you have validated findings based on the CI tests and deployment"
      ],
      "metadata": {
        "id": "AtSoltIyvFvY"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "#check on runner status\n",
        "!git log"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "mg4tJmZDxMtU",
        "outputId": "046168d0-784c-4238-8ba0-e262f3cf451d"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[33mcommit 7d8a12f4158b208646ba24d05535a8bb238969e7\u001b[m\u001b[33m (\u001b[m\u001b[1;36mHEAD -> \u001b[m\u001b[1;32mmain\u001b[m\u001b[33m, \u001b[m\u001b[1;31morigin/main\u001b[m\u001b[33m, \u001b[m\u001b[1;31morigin/HEAD\u001b[m\u001b[33m)\u001b[m\n",
            "Author: Dennis Chow <dchow@xtecsystems.com>\n",
            "Date:   Mon Jan 22 01:34:30 2024 +0000\n",
            "\n",
            "    added buildspec\n",
            "\n",
            "\u001b[33mcommit 78204483da12ad1e2b39a372f0894564411c9939\u001b[m\n",
            "Author: SCIS Security <4706268+dc401@users.noreply.github.com>\n",
            "Date:   Sun Jan 21 19:29:02 2024 -0600\n",
            "\n",
            "    Delete buildspec.txt\n",
            "\n",
            "\u001b[33mcommit fbfee73846d60f8e51b4f602a4c75b5f04d64de2\u001b[m\n",
            "Author: Dennis Chow <dchow@xtecsystems.com>\n",
            "Date:   Mon Jan 22 01:23:26 2024 +0000\n",
            "\n",
            "    added buildspec\n",
            "\n",
            "\u001b[33mcommit 55bd18a05a15a7cca1a0f3a9c814a16bf52236ac\u001b[m\n",
            "Author: SCIS Security <4706268+dc401@users.noreply.github.com>\n",
            "Date:   Sun Jan 21 01:01:03 2024 -0600\n",
            "\n",
            "    Add files via upload\n",
            "\n",
            "\u001b[33mcommit 4d9101913269461769bd8a8414f9d6ba3322d0ff\u001b[m\n",
            "Author: SCIS Security <4706268+dc401@users.noreply.github.com>\n",
            "Date:   Sun Jan 21 00:32:35 2024 -0600\n",
            "\n",
            "    Created using Colaboratory\n",
            "\n",
            "\u001b[33mcommit 2963aea0acbcb8edecb631679f37a93774104242\u001b[m\n",
            "Author: SCIS Security <4706268+dc401@users.noreply.github.com>\n",
            "Date:   Sat Jan 20 23:46:29 2024 -0600\n",
            "\n",
            "    Initial commit\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [],
      "metadata": {
        "id": "bNt1x5olzhja"
      },
      "execution_count": null,
      "outputs": []
    }
  ]
}